Legislative Update: Missouri & Illinois Address Issue of Employer Requests for Employee/Job Applicant Social Media Account Information (Part 2 – Missouri)

Legislation addressing the question of the extent to which an employer may request an employee’s social media account information has been introduced or is pending in 36 states with seven already enacting legislation in 2013.

As a follow-up to the discussion of Illinois’ recent legislative efforts, let’s look at Missouri’s legislative efforts.

Unfortunately, at this time the Missouri Legislature has not enacted any legislation to clarify the question of whether an employer may lawfully request or require employees or job applicants provide that employer with their social media account login information. Although the 2013 legislation session recently ended without a bill being passed in both houses, one bill, Senate Committee Substitute / Senate Bill 164, which would have created “The Password Privacy Protection Act,” passed in the Senate and fell just one vote shy of passage in the House. This bill’s partial success likely indicates the direction Missouri will ultimately take.

Like the Illinois legislation, SCS/SB164 began with a general ban of the practice of requesting or requiring the disclosure of account information. Specifically, the bill read:

Subject to the exceptions provided in subsection 4 of this section, an employer shall not request or require an employee or applicant to disclose any user name, password, or other authentication means for accessing any personal online account or personal online service.

The exceptions include and relate to:

(1)   Any electronic communications device supplied by or paid for in whole or in part by the employer;

(2)   Any accounts or services provided by the employer;

(3)   Any account or services the employee uses for business purposes; or

(4)   Any accounts or services used as a result of the employee’s employment relationship with the employer.

The bill also included several anti-retaliation provisions and a provision barring employees from transferring “an employer’s proprietary or confidential information or financial data to an employee’s personal online account” or service without employer authorization (i.e., barring an employee from posting trade secrets on Facebook without permission).

Like its Illinois counterpart, SCS/SB164 sought to clarify what it was not intended to do as well. It specifically stated, in part, that it should not be construed to prevent an employer from restricting or prohibiting an employee’s access to certain websites while using devices paid for by the employer, monitoring electronic data stored on an electronic communications device paid for by the employer (or such data that is traveling through or stored on an employer’s network), or restricting an employer’s review of public domain information.

While the bill sought to remedy one perceived problem, it may have actually emphasized another. The bill’s exception for employer-paid devices and interpretation not to prevent monitoring of data stored on such devices or flowing across employer’s networks leaves open the issue of the extent to which an employer may obtain an employee’s social media account information, or any information such as bank or health information, stored on the employer-paid device. Hopefully this potential loophole will be addressed when the Missouri Legislature reconvenes in the next session.

Although SCS/SB164 demonstrates what form a successful bill on this topic might take, SCS/SB164 has not been passed by the Missouri Legislature or signed into law. Therefore, the question remains unsettled in Missouri at this time.